Report - translucent-slime-birthday.glitch.me/public/Member.html

Report Overview

Visited public
2023-11-26 00:46:57
Tags
suspicious
URL
translucent-slime-birthday.glitch.me/public/Member.html
Finishing URL
translucent-slime-birthday.glitch.me/public/Member.html
IP / ASN
34.196.51.7
#14618 AMAZON-AES
Title
Member Account Login | USAA
Suspicious - Suspicious Javascript code

Detections

urlquery

Network Intrusion Detection

Threat Detection Systems

Domain Summary

Domain / FQDN	Rank	Registered	First Seen	Last Seen	Sent	Received	IP
translucent-slime-birthday.glitch.me	unknown	unknown	No data	No data	521 B	1.6 MB	52.2.151.71
cdnjs.cloudflare.com	235	2009-02-17	2015-04-17 22:46:33	2023-11-25 05:09:33	495 B	6.6 kB	104.17.24.14
l2.io	163527	2012-05-12	2015-06-25 03:31:26	2023-11-25 03:28:42	429 B	226 B	195.80.159.133

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Timestamp	Severity	Source IP	Destination IP	Alert
2023-11-26 00:46:42	high	Client IP	Internal IP	ET PHISHING Possible Glitch.me Phishing Domain
2023-11-26 00:46:42	high	Client IP	Internal IP	ET PHISHING Possible Glitch.me Phishing Domain
2023-11-26 00:46:42	medium	Client IP	Internal IP	ET HUNTING Suspicious Glitch Hosted DNS Request - Possible Phishing Landing
2023-11-26 00:46:42	medium	Client IP	Internal IP	ET HUNTING Suspicious Glitch Hosted DNS Request - Possible Phishing Landing
2023-11-26 00:46:42	high	Client IP	Internal IP	ET PHISHING Possible Glitch.me Phishing Domain
2023-11-26 00:46:42	medium	Client IP	Internal IP	ET HUNTING Suspicious Glitch Hosted DNS Request - Possible Phishing Landing
2023-11-26 00:46:43	medium	Client IP	52.2.151.71	ET HUNTING Suspicious Glitch Hosted TLS SNI Request - Possible Phishing Landing
2023-11-26 00:46:44	medium	Client IP	Internal IP	ET POLICY Observed IP Lookup Domain (l2 .io in DNS Lookup)
2023-11-26 00:46:44	medium	Client IP	Internal IP	ET POLICY Observed IP Lookup Domain (l2 .io in DNS Lookup)
2023-11-26 00:46:44	medium	Client IP	195.80.159.133	ET POLICY Observed IP Lookup Domain (l2 .io in TLS SNI)

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected

OpenPhish

Scan Date	Severity	Indicator	Alert
2023-11-25	medium	translucent-slime-birthday.glitch.me/public/Member.html	United Services Automobile Association

PhishTank

No alerts detected

mnemonic secure dns

No alerts detected

Quad9 DNS

No alerts detected

ThreatFox

No alerts detected

JavaScript (19)

	URL	From	Size	First Seen	Last Seen
	l2.io/ip.js?var=userip	ScriptElement	24 B	2023-03-07	2025-05-09
Pretty URL l2.io/ip.js?var=userip IP 195.80.159.133 ASN #29152 Decknet S.a.r.l. Introduced by scriptElement Embedded in HTML false Observations First Seen2023-03-07 01:02 Last Seen2025-05-09 07:36 Times Seen1137 Hash f9dc91b3feea65bd389a2f5b57306c32 147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77 Loading...

	unknown	ScriptElement	366 B	2023-11-08	2024-08-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-08 12:27 Last Seen2024-08-20 20:25 Times Seen6 Hash 3c89b660c82b3c89296f07c6ab5523ba bb1275814e1bdcc330c006225fbcbecc9b5be70f 9a15929d6ea6985eea1c058a1816db6a27296412e4b078e503ea9dcd04081412 Loading...

	unknown	ScriptElement	1.8 kB	2023-11-08	2024-08-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-08 12:27 Last Seen2024-08-20 20:25 Times Seen6 Hash 0c581de7c06e8f0afc49ba87477d4db9 e6d0a75820ab8a1553588c6ce14fc4c3bb1131ef 6b5b90a8bfe85891317bb121eb82a92dfbfd0635cd3eb57fc2796185743412fd Loading...

	unknown	ScriptElement	2.5 kB	2023-11-08	2024-08-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-08 12:27 Last Seen2024-08-20 20:25 Times Seen6 Hash 8b05e4d22a7505e63a2aa898df8457fa 01ccd38ad49b3f086cda2c245e6f21dfb9eee213 eefffe044982c9d413f6ddca09463d1dee44a798a34ab48aa927d030cdd5f45a Loading...

	unknown	ScriptElement	6.1 kB	2023-11-08	2024-08-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-08 12:27 Last Seen2024-08-20 20:25 Times Seen6 Hash 3589743b86670d76d7cf090640e79780 5dcc14cef676ee28447b4252dfa20421aa000e90 43dc5687bf959f20f23f44221129096b44dffd79a964d760a0535d199b227f66 Loading...

	unknown	ScriptElement	2.5 kB	2023-11-08	2024-08-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-08 12:27 Last Seen2024-08-20 20:25 Times Seen6 Hash dc4cb93e4e297aaff8b63c2d19cbc674 245cfec797b8df721afa02998159524ebd0b2c24 b58446d62120d02748fcc17db1a19ee5ffcdcc4539338a5d7ca7b4a52c8fe1ed Loading...

	unknown	ScriptElement	2.3 kB	2023-11-08	2024-08-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-08 12:27 Last Seen2024-08-20 20:25 Times Seen6 Hash 3f58489b25fb005b7da47e18223c641d dd8a54fa1d3d90b7b56e0477897f728dd51a8b0a e36c635e1cd0a89aab3d8aeb341a5db9c05ad9650baba4c2ae88d14a7c9e3525 Loading...

	translucent-slime-birthday.glitch.me/public/Member.html	ScriptElement	1.6 MB	2023-11-08	2024-08-20
Pretty URL translucent-slime-birthday.glitch.me/public/Member.html IP 52.2.151.71 ASN #14618 AMAZON-AES Introduced by scriptElement Embedded in HTML true Observations First Seen2023-11-08 12:27 Last Seen2024-08-20 20:25 Times Seen6 Hash 5225b2d3cbcbe329b6bbce05d493ffe4 2be518eecc1d5f9c62b924ed1a6b4f384dcfb34e fe81f10cb4e067c0ff47bdb9f0a83f7a2cfb388a0edc906145c7a9b042dfdc9b Loading...

	unknown	ScriptElement	900 B	2023-11-08	2024-08-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-08 12:27 Last Seen2024-08-20 20:25 Times Seen6 Hash ac1799e2c454c7dc828c8677de135267 57c28fd51deab74c767cb10dc2eb845fec872d5d 16543f6ccbc81aa0c470fbdf420e2024bb035b4710b45f149b1232eb18f17e20 Loading...

	unknown	ScriptElement	423 B	2023-11-08	2024-08-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-08 12:27 Last Seen2024-08-20 20:25 Times Seen6 Hash 609af04118976731c59d959de5fe22a6 663233e254623fc6b482a30f74bf0023d9d36a4b 7c0bd31df74d0fa1476b03b3bc06a94029a7fd6965df799221b02e8f84b91f78 Loading...

	unknown	ScriptElement	1.3 kB	2023-11-08	2024-08-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-08 12:27 Last Seen2024-08-20 20:25 Times Seen6 Hash a223507d548b0b1e6d1a37ceb0cfb360 be6b68c22dbed462950ce66ee436b1c1f1e81ad9 896cc2c1807e990d91c1fd17046972df22d20333be0952c766824cb82a4bbe64 Loading...

	unknown	ScriptElement	1.5 kB	2023-11-08	2024-08-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-08 12:27 Last Seen2024-08-20 20:25 Times Seen6 Hash d0c9165e5d478f308e2f39027acdb0b9 e4b6379f6f07c92c8abd647f2a751a6484aefe6b 3df5265fbc9218c1b66b373ba918f948bcd484e4b528399f11cd423399d8dc27 Loading...

	unknown	ScriptElement	1.7 kB	2023-11-08	2024-08-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-08 12:27 Last Seen2024-08-20 20:25 Times Seen6 Hash 3359f4eb178fb80214069f29a0ff9207 cd96a4d0eb552e536851b7778105ae9f48fc23ee 778c7a09779974738d2a18c0549aa89f11039e4411b2e11ffb54b170612825d4 Loading...

	unknown	ScriptElement	2.0 kB	2023-11-08	2024-08-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-08 12:27 Last Seen2024-08-20 20:25 Times Seen6 Hash 8767658574254c89eb72c3e4dcf9f284 58063779c40344b8230fcd26a252da53e671e352 aafd98942ffa936f17c9e9b2adc4ddc76319ed26b889f4151f55ea229f524792 Loading...

	unknown	ScriptElement	1.4 kB	2023-11-08	2024-08-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-08 12:27 Last Seen2024-08-20 20:25 Times Seen6 Hash 1a7a86b5d350066f6bb9ebedd93affd9 b6e073fd5530e9c4dc4d913cba29b138a1f4278f 0b2899e3932b0449ebcb957d1afdd28522b020a6a541967c9eb62ea9ce3ab9a1 Loading...

	unknown	ScriptElement	2.2 kB	2023-11-08	2024-08-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-08 12:27 Last Seen2024-08-20 20:25 Times Seen6 Hash da0ba7206c26683e684a72dc002c3050 d15c54736e4b3393b6af2c19fcf4e479124fa17d 97b9e6e5e6a34e4cd15d5f058d97965ba9f47f3360cb94461ea53538867f84ab Loading...

	unknown	ScriptElement	1.9 kB	2023-11-08	2024-08-20
Pretty Introduced by scriptElement Embedded in HTML false Observations First Seen2023-11-08 12:27 Last Seen2024-08-20 20:25 Times Seen6 Hash b334f1cd79176d227bc4e528422c0e84 4126376802a1c194ffd22a646eff61c7b49905d7 49fa2bfd27786c07e6d6492e80cbf04b45c3241d5ceefa81f1e6031bd4e16739 Loading...

		Size	First Seen	Last Seen
	#1 Write - 7ac8c83cac812c2c2eaca3ff808d744d	533 kB	2023-11-08 12:27	2024-08-20 20:25
Pretty Observations First Seen2023-11-08 12:27 Last Seen2024-08-20 20:25 Times Seen6 Hash 7ac8c83cac812c2c2eaca3ff808d744d 5a27afce22df8a6c828886aeee5d48a49d36399d 72bb60314a452379a89fcdf2e6fdfa921b56a3ddf8eebad2952aa8c9f82a12c4 Loading...

	#2 Write - 16a2baab94de13d45b6102885b357dae	1.8 kB	2023-11-04 19:28	2025-04-25 08:57
Pretty Observations First Seen2023-11-04 19:28 Last Seen2025-04-25 08:57 Times Seen25 Hash 16a2baab94de13d45b6102885b357dae d4b4490e17bbc56dd8846265d992500c79af8665 ff678ba8230d9852df38f0a1fdbe69a8dc4ad914da5fcc2005e572d07b00c0bd Loading...

HTTP Transactions (3)

URL IP Response Size

translucent-slime-birthday.glitch.me/public/Member.html

52.2.151.71

200 OK

1.6 MB

URL User Request GET HTTP/2
translucent-slime-birthday.glitch.me/public/Member.html
IP
52.2.151.71:443
ASN
#14618 AMAZON-AES

Certificate
IssuerAmazon
Subjectglitch.com
Fingerprint13:93:2D:E4:50:7E:CE:BA:BC:F9:6D:7E:86:7F:43:5D:8E:63:45:3E
ValidityWed, 22 Feb 2023 00:00:00 GMT - Thu, 01 Feb 2024 23:59:59 GMT

File type
HTML document text\012- exported SGML document, ASCII text, with very long lines (65443)
Size
1.6 MB (1599377 bytes)
Hash
dacf7ac33c12f354c5edc9e561b80ee8
9c3f935e3941bfe0ed6f460c4df0362ee8968162
c32c2ebed560ffc45735022ced725d3bf376313ea4cf80db1b0dbe05e55f3b2a

Detections

Analyzer	Verdict	Alert
OpenPhish	phishing	United Services Automobile Association

HTTP Headers

GET /public/Member.html HTTP/1.1
Host: translucent-slime-birthday.glitch.me
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sun, 26 Nov 2023 00:46:40 GMT
content-type: text/html; charset=utf-8
content-length: 1599377
x-amz-id-2: uurkeNZzQXXo41v9JoLTyUZpJJF7gcFGNLHV7STg/hsLbskIBc1h36BK9ny1fpJeF+FNm1QruWw=
x-amz-request-id: PQGKMYG2EAF4NB9W
last-modified: Wed, 22 Nov 2023 12:13:32 GMT
etag: "dacf7ac33c12f354c5edc9e561b80ee8"
x-amz-server-side-encryption: AES256
cache-control: no-cache
x-amz-version-id: null
accept-ranges: bytes
server: AmazonS3
X-Firefox-Spdy: h2

cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css

104.17.24.14

200 OK

5.6 kB

URL GET HTTP/2
cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css
IP
104.17.24.14:443
ASN
#13335 CLOUDFLARENET

Requested by
https://translucent-slime-birthday.glitch.me/public/Member.html
Certificate
IssuerCloudflare, Inc.
Subjectsni.cloudflaressl.com
Fingerprint7A:EA:B9:09:71:70:6C:87:C9:D3:82:74:8A:7B:B4:60:E5:40:2D:8D
ValidityMon, 03 Jul 2023 00:00:00 GMT - Tue, 02 Jul 2024 23:59:59 GMT

File type
ASCII text, with very long lines (30837)
Size
5.6 kB (5631 bytes)
Hash
269550530cc127b6aa5a35925a7de6ce
512c7d79033e3028a9be61b540cf1a6870c896f8
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

HTTP Headers

GET /ajax/libs/font-awesome/4.7.0/css/font-awesome.min.css HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://translucent-slime-birthday.glitch.me/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/2 200 OK
date: Sun, 26 Nov 2023 00:46:41 GMT
content-type: text/css; charset=utf-8
content-length: 5631
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "5eb03e5f-7918"
last-modified: Mon, 04 May 2020 16:10:07 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 2502156
expires: Fri, 15 Nov 2024 00:46:41 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tDtVna3tVEzbzYSALOYi%2FL8IwR3bwL563gMs%2Fb3V17su5gYGJErvEtccX2Qsbl8Gkl6aamiO7redIZQm4Bb%2BlW%2Bf1PP9Lyzh%2B4oDYdALxi4AVSePydpPoOxnh3cQZuC%2BpAz%2F7Yvb"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
cf-ray: 82be1da31bbe56a5-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2

l2.io/ip.js?var=userip

195.80.159.133

200 OK

24 B

URL GET HTTP/1.1
l2.io/ip.js?var=userip
IP
195.80.159.133:443
ASN
#29152 Decknet S.a.r.l.

Requested by
https://translucent-slime-birthday.glitch.me/public/Member.html
Certificate
IssuerLet's Encrypt
Subjectl2.io
Fingerprint65:49:ED:2D:E9:35:D9:26:3D:70:87:2B:4F:20:FF:14:56:55:52:B4
ValidityTue, 17 Oct 2023 07:33:55 GMT - Mon, 15 Jan 2024 07:33:54 GMT

File type
ASCII text, with no line terminators
Size
24 B (24 bytes)
Hash
f9dc91b3feea65bd389a2f5b57306c32
147d1c9ae79ae948a34c5f1254bdcbf7af9caf8e
d88923af30873abcf4cde709062c3d2e9ded181f9e2552c7fbcc983b3796ff77

HTTP Headers

GET /ip.js?var=userip HTTP/1.1
Host: l2.io
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://translucent-slime-birthday.glitch.me/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

HTTP/1.1 200 OK
Date: Sun, 26 Nov 2023 00:46:43 GMT
Server: Apache/2.4.38 (Debian)
Content-Length: 24
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Report Overview

Domain Summary

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

Threat Detection Systems

Public InfoSec YARA rules

OpenPhish

PhishTank

mnemonic secure dns

Quad9 DNS

ThreatFox

JavaScript (19)

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

URL

IP

ASN

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by

Embedded in HTML

Observations

Hash

Introduced by